OpenClaw Mastery

• Outcome: Review
• Latest audit: Sep 10, 2026 · 8:56 PM UTC
• Version: 1.0.0

Overview

The skill is mostly a disclosed OpenClaw operations guide, but some templates encourage broad persistent autonomy, private-data automation, and unsafe secret handling without enough limits.

Install only if you are comfortable treating this as a high-power operations playbook, not a safe default configuration. Before using it, remove or rewrite the 'run EVERYTHING autonomously' template, make memory logging opt-in and redacted, avoid relaying inbox/calendar content through chat unless explicitly scoped, use a real secret manager instead of sourced plaintext env files, and pin or verify any packages and skills you install.

A.I.G

Vulnerability Patterns

• Unauthorized Access and Privilege Escalation: Obtains permissions beyond the task's legitimate needs
• Insecure Dependencies: Introduces malicious components through unsafe dependency sources
• Insecure Skill Coding Practices: Finds exploitable flaws such as hardcoded secrets or command injection
• Skill Instruction Hijacking: Alters the agent's session goals or safety constraints when the skill loads
• Agent Memory Poisoning: Writes attacker-controlled rules into memory that affect later sessions

Findings (3)

T08 · Insecure Dependencies

Warning

• Location: SKILL.md:50
• Finding: Unpinned Third-Party Package and Skill Installation## Vulnerability Details **File Location**: `SKILL.md:50`, `SKILL.md:521`, `SKILL.md:580`, `SKILL.md:842`; `README.md:14` **Vulnerability Type**: Supply-chain exposure through unpinned dependencies **Risk Level**: Medium ### Vulnerable Code ```bash # SKILL.md:50 npm install -g openclaw # SKILL.md:521 clawhub install afrexai-email-marketing-engine # SKILL.md:580 brew install 1password-cli # SKILL.md:842 clawhub install afrexai-[name] # README.md:14 clawhub install afrexai-openclaw-mastery ``` ### Technical Analysis The documented installation commands do not pin package or Skill versions and do not verify checksums, signatures, lockfiles, or publisher identities. Consequently, the components installed when a user follows these instructions can differ from the versions that existed when this artifact was audited. Global installation of `openclaw` increases the potential impact because the resulting executable is placed in the user's global command environment. ClawHub Skills can also introduce new instructions or executable content into an agent environment. A compromised publisher account, registry, package release, or mutable Skill could therefore introduce behavior not represented by the reviewed files. The Homebrew installation is sourced from a well-known package manager, but it remains unpinned and is included because the instructions provide no integrity or version controls. ### Attack Path 1. An attacker compromises a referenced publisher account, package registry entry, or upstream distribution channel. 2. The attacker publishes a malicious version under the same package or Skill name. 3. A user follows one of the unpinned installation commands. 4. The package manager retrieves the latest mutable release rather than a specifically reviewed version. 5. Malicious package installation logic, executable code, or Skill instructions run in the user's environment. 6. The payload operates with the ...[truncated 883 chars]
• Remediation: ## Remediation Suggestions 1. Pin every package and Skill to a specifically reviewed version. 2. Where supported, verify publisher signatures and cryptographic checksums before installation. 3. Record expected hashes and trusted registry endpoints in the documentation. 4. Review the complete contents and installation hooks of each Skill or package before use. 5. Prefer project-local or isolated installation over global installation. 6. Use lockfiles or equivalent immutable dependency manifests where available. 7. Test new versions in a sandbox with restricted filesystem, network, credential, and channel access before promotion. 8. Establish an explicit update-review process rather than recommending unrestricted bulk updates.

T09 · Insecure Skill Coding Practices

Error

• Location: SKILL.md:592
• Finding: Plaintext Secret Storage and Unsafe Shell Sourcing## Vulnerability Details **File Location**: `SKILL.md:592-597` **Vulnerability Type**: Plaintext credential exposure and shell-command injection **Risk Level**: High ### Vulnerable Code ```bash ### Alternative: Environment Variables # Store in ~/.openclaw/vault/ (gitignored) echo "export MY_KEY=value" > ~/.openclaw/vault/my-service.env # Source in scripts source ~/.openclaw/vault/my-service.env ``` ### Technical Analysis The documented fallback stores credentials as plaintext in a file. Naming the directory `vault` and excluding it from Git do not provide encryption or protection from other local processes, backups, malware, or filesystem permission mistakes. The command does not establish a restrictive `umask`, explicitly set mode `600`, validate directory ownership, or prevent symbolic-link attacks. Depending on the user's existing environment and directory permissions, the resulting file may be readable or replaceable by another local principal. More critically, `source` does not parse the file as passive environment data. It executes its contents as shell code in the context of the calling script. If an attacker can modify or replace `my-service.env`, arbitrary shell commands inserted into that file execute with the privileges of the process sourcing it. ### Attack Path 1. A user follows the documentation and writes an API key to `~/.openclaw/vault/my-service.env`. 2. The file is created without explicit restrictive permission and ownership enforcement. 3. A malicious local process, compromised backup integration, or another principal with filesystem access reads the plaintext credential or modifies the file. 4. For credential theft, the attacker uses the recovered key directly against the associated service. 5. For command injection, the attacker adds shell syntax such as a command substitution or an additional command to the environment file. 6. A trusted automation script later executes `source ~/.open ...[truncated 915 chars]
• Remediation: ## Remediation Suggestions 1. Use the recommended operating-system keychain or a dedicated secret manager instead of plaintext files. 2. Retrieve secrets only at runtime and keep their lifetime in process memory as short as possible. 3. If file-based storage is unavoidable: - Create the parent directory with mode `700`. - Set `umask 077` before creating the file. - Set the file mode to `600`. - Verify that both the directory and file are owned by the expected user. - Reject symbolic links and unexpected file types. - Exclude the location from backup and synchronization systems unless backups are encrypted. 4. Do not use `source` to load credential files. 5. Parse a strict data format that permits only expected key names and values and never evaluates shell syntax. 6. Apply least-privilege scopes, expiration, rotation, and usage limits to every stored key. 7. Add secret scanning and filesystem-permission checks to deployment validation.

T05 · Unauthorized Access and Privilege Escalation

Error

• Location: SKILL.md:667
• Finding: Unrestricted Persistent Autonomous-Operation Template## Vulnerability Details **File Location**: `SKILL.md:667-675` **Vulnerability Type**: Removal of approval boundaries for privileged agent actions **Risk Level**: High ### Vulnerable Code ```markdown ### Pattern 2: Autonomous Operations For truly autonomous agents: ## In AGENTS.md: OPERATOR IS OUT OF THE LOOP — run EVERYTHING autonomously. Only message when: 💰 sale, 📊 morning/evening briefing, 🚨 critical break. ``` ### Technical Analysis The template instructs users to place a broad autonomy rule in persistent `AGENTS.md` configuration. The phrase `run EVERYTHING autonomously` does not define an allowlist, privilege boundary, spending limit, data boundary, or confirmation requirement. Because `AGENTS.md` is described elsewhere in the Skill as an operating manual loaded during session startup, this rule can affect future sessions rather than only the immediate task. It also conflicts with the safer rule in `SKILL.md:601` requiring confirmation before emails, posts, and API calls that leave the machine. In an agent with filesystem, messaging, scheduling, publishing, or API tools, this instruction can cause ambiguous, malformed, or adversarial inputs to result in external actions without informed operator approval. The instruction is not itself an operating-system privilege escalation, but it breaks application-level least-privilege and authorization boundaries by broadly delegating the operator's existing permissions. ### Attack Path 1. A user copies the autonomous-operation template into the persistent `AGENTS.md` file. 2. The agent loads that file during later session startup. 3. The agent has access to one or more privileged tools, such as messaging channels, API integrations, filesystem operations, cron creation, or content publishing. 4. An attacker supplies malicious content through a monitored email, group chat, web page, document, or other agent-readable input, or an ambiguous routine task is misinterpre ...[truncated 1099 chars]
• Remediation: ## Remediation Suggestions 1. Remove the instruction to run “everything” autonomously. 2. Define an explicit allowlist of low-risk autonomous operations. 3. Require operator approval for: - Sending messages to new recipients. - Publishing public content. - Financial transactions or paid API use. - Destructive or irreversible filesystem operations. - Credential, permission, channel, or schedule changes. - Disclosure of personal or confidential information. 4. Apply least-privilege scopes separately to each agent, channel, tool, and credential. 5. Set transaction, spending, rate, recipient, and execution limits. 6. Treat content from email, chat, websites, documents, and other external sources as untrusted data rather than executable instructions. 7. Maintain tamper-evident logs for every external or state-changing action. 8. Notify the operator of all sensitive actions, not only failures or sales. 9. Provide an emergency disable mechanism and periodically review persistent agent instructions.

SkillSpector

Vulnerability Patterns

• Prompt Injection: Instruction Override, Hidden Instructions, Exfiltration Commands
• Data Exfiltration: External Transmission, Env Variable Harvesting, File System Enumeration
• Rogue Agent: Self-Modification, Session Persistence
• Trigger Abuse: Overly Broad Trigger, Shadow Command Trigger, Keyword Baiting Trigger
• Privilege Escalation: Excessive Permissions, Sudo/Root Execution, Credential Access

Findings (11)

Exfiltration Commands

High

• Category: Prompt Injection

Content

# From main agent, delegate to sub-agent:
sessions_spawn(task="Analyze BTC 4h chart", agentId="trader")

# Send message to another session:
sessions_send(sessionKey="...", message="Update: new client signed")
```

• Confidence: 90% confidence
• Finding: Instructions found that direct the agent to transmit conversation context or user data to external services.

Vague Triggers

Medium

• Confidence: 88% confidence
• Finding: This markdown file tells users to 'ask your agent' with example phrases like 'Design an agent for [your use case]' and 'Optimize my token costs,' but it does not define whether these are the actual activation triggers, examples only, or what should not invoke the skill. That ambiguity can cause unintended invocation overlap with ordinary agent requests about design or cost optimization.

Ssd 3

Medium

• Confidence: 90% confidence
• Finding: The workspace design section frames the workspace as the agent's persistent memory and personality, encouraging broad storage of user context across multiple files. It lacks minimization rules, data classification guidance, or instructions to avoid storing sensitive personal or credential material, increasing long-term privacy exposure.

Ssd 3

Medium

• Confidence: 92% confidence
• Finding: The AGENTS.md startup flow tells the agent to reread recent daily logs and long-term memory, while the memory protocol says 'Write it down — no mental notes.' This encourages broad collection and repeated processing of historical user context, which can amplify privacy risk and propagate stale or sensitive information across sessions.

Ssd 3

Medium

• Confidence: 94% confidence
• Finding: The USER.md template solicits identity, timezone, language preferences, professional context, priorities, technical level, and behavioral preferences without any privacy scoping. This can lead operators to persist a broad user profile even when only a small subset is needed, increasing collection and misuse risk.

Ssd 3

Medium

• Confidence: 93% confidence
• Finding: The memory maintenance protocol recommends automatic daily logging of raw events and later distillation into long-term memory, which normalizes persistent retention of user activity history. Raw logs often capture sensitive details, and without minimization or expiration controls they can become a durable privacy liability.

Missing User Warnings

Medium

• Confidence: 93% confidence
• Finding: The skill instructs the agent to write daily notes automatically and distill them into long-term memory, but it does not prominently warn that user data and agent activity will be persistently stored and modified. This creates a risk of silent data retention, incorrect memory formation, and unintended modification of workspace state.

Missing User Warnings

Medium

• Confidence: 95% confidence
• Finding: The cron examples instruct the agent to autonomously check email inboxes, calendars, weather, and then summarize results to the operator, which involves access to private communications and external services. Without a prominent consent and review boundary, this can normalize autonomous handling of sensitive data and external actions beyond the user's expectations.

Ssd 3

Medium

• Confidence: 95% confidence
• Finding: The 'Morning Ops' workflow directs the agent to inspect email and calendar data and summarize urgent items via Telegram. This can collect, transform, and retransmit sensitive communications through another channel, raising the risk of oversharing, leakage, or insecure relay of private information.

Vague Triggers

Medium

• Confidence: 90% confidence
• Finding: The skill defines broad natural-language commands such as 'Assess my OpenClaw setup' and similar generic phrases that can overlap with ordinary user conversation. In systems that auto-activate skills based on phrase matching, this can cause unintended invocation of powerful setup or automation workflows without clear user intent.

Session Persistence

Medium

• Category: Rogue Agent

Content

1. **"Assess my OpenClaw setup"** → Run maturity scoring across all dimensions
2. **"Design an agent for [purpose]"** → Full SOUL.md + AGENTS.md + config generation
3. **"Set up multi-agent architecture"** → Config template + workspace structure
4. **"Create a cron job for [task]"** → Schedule design + payload + delivery
5. **"Optimize my token costs"** → Analyze usage + recommend model/frequency changes
6. **"Debug why [X] isn't working"** → Troubleshooting checklist walkthrough
7. **"Set up [channel] integration"** → Step-by-step channel config

• Confidence: 80% confidence
• Finding: Skill establishes unauthorized persistence across sessions via cron jobs, startup scripts, or state files. Session persistence allows an attacker to maintain access beyond the current interaction.

Static analysis

No suspicious patterns detected.